CIS Ubuntu 14.04 LTS - 5.2.6 Ensure SSH IgnoreRhosts is enabled

Verify SSH IgnoreRhosts is set to yes to prevent .rhosts-based authentication

cyberstrikeus Updated

File contents

5.2.6 Ensure SSH IgnoreRhosts is enabled (Scored)

Profile Applicability

  • Level 1 - Server
  • Level 1 - Workstation

Description

The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication.

Rationale

Setting this parameter forces users to enter a password when authenticating with ssh.

Audit Procedure

Run the following command and verify that output matches:

grep "^IgnoreRhosts" /etc/ssh/sshd_config

Expected Result

IgnoreRhosts yes

Remediation

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

IgnoreRhosts yes

Default Value

IgnoreRhosts yes

References

  • CIS Controls: 9 - Limitation and Control of Network Ports, Protocols, and Services

Profile

  • Level 1 - Server
  • Level 1 - Workstation

cyberstrikeus/cyberstrike/tree/main/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-5-2-6 commit 6b0a2f2caf

Frequently asked questions

npx skillmds@latest add cyberstrikeus/cis-ubuntu-14-04-lts-5-2-6-ensure-ssh-ignorerhosts-is-enable